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IN THE CLAIMS 
Amended Claims follow: 

1 . (Currently Amended) A method for processing network accounting 
information, comprising: x 

(a) receiving accounting information over a packet-switched network; 

(b) monitoring at least one aspect of the received accounting information; and 

( c ) after recei ving the accounting information, d iscarding at least a portion of the 
accounting information that occurs during a surge in network traffic, based 
on the monitored aspect. 

2. (Original) The method as recited in claim 1, wherein the accounting 
information is discarded for providing a defense against network attacks. 

3. (Original) The method as recited in claim 1, wherein the accounting 
information is discarded for dealing with heavy network traffic. 

4. (Original) The method as recited in claim 3, and further comprising 
generating a summary of the accounting information. 

5. (Original) The method as recited in claim 1, wherein monitoring the at least 
one aspect of the received accounting information includes detecting a scan 
of a plurality of ports. 

6. (Original) The method as recited in claim 1, wherein monitoring the at least 
one aspect of the received accounting information includes detecting a scan 
of a plurality of Internet Protocol (TP) addresses. 

7. (Original) The method as recited in claim 1, wherein monitoring the at least 
one aspect of the received accounting information includes monitoring a rate 
of receipt of the accounting information. 
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8. (Original) The method as recited in claim 7, wherein monitoring the at least 
one aspect of the received accounting information includes detecting whether 
the rate of receipt of the accounting information exceeds a predetermined 
amount. 

9. (Original) The method as recited in claim 1, wherein monitoring the at least 
one aspect of the received accounting information includes monitoring a load 
on a system receiving the accounting information. 

10. (Original) The method as recited in claim 1, wherein the network includes 
the Internet. 

1 1 . (Currently Amended) A computer program product for processing network 
accounting information, comprising: 

(a) computer code for receiving accounting information over a packet-switched 
network; 

(b) computer code for monitoring at least one aspect of the received accounting 
information; and 

(c) computer code for discarding at least a portion of the accounting information 
that occurs during a surge in network traffic, based on the monitored aspect 
after receiving the accounting information . 

12. (Original) The computer program product as recited in claim 1 1, wherein the 
accounting information is discarded for providing a defense against network 
attacks. 

1 3 . (Original) The computer program product as recited in claim 1 1 , wherein the 
accounting information is discarded for dealing with heavy network traffic. 
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14. (Original) The computer program product as recited in claim 13, and further 
comprising computer code for generating a summary of the accounting 
information. 

15. (Original) The computer program product as recited in claim 1 1 , wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for detecting a scan of a 
plurality of Internet Protocol (IP) addresses. 

1 6. (Original) The computer program product as recited in claim 1 1 , wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for monitoring a rate of 
receipt of the accounting information. 

17. (Original) The computer program product as recited in claim 16, wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for detecting whether the 
rate of receipt of the accounting information exceeds a predetermined 
amount. 

1 8. (Original) The computer program product as recited in claim 1 1 , wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for detecting a scan of a 
plurality of ports. 

19. (Original) The computer program product as recited in claim 1 1 , wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for monitoring a load on a 
system receiving the accounting information. 

20. (Currently Amended) A system for processing network accounting 
information, comprising: 

XACCTP001 
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(a) logic for receiving accounting information over a packet-switched network; 

(b) logic for monitoring at least one aspect of the received accounting 
information; and 

(c) logic for discarding at least a portion of the accounting information that 
occurs during a surge in network traffic, based on the monitored aspect^agto; 
receiving the account in g information . 

2 1 . (Previously Amended) A method for processing network accounting 
information, comprising: 

(a) receiving accounting information over a packet-switched network; 

(b) monitoring at least one aspect of the received accounting information; and 

(c) conditionally preventing an overload of the accounting information that 
occurs during a surge in network traffic, based on the monitored aspect. 

22. (Previously Amended) A method for processing network accounting 
information, comprising: 

(a) receiving accounting information over a packet-switched network; 

(b) receiving an indication relating to at least one aspect of the received 
accounting information; and 

(c) conditionally preventing an overload of the accounting information that 
occurs during a surge in network traffic, based on the indication. 

23 . (Previously Amended) A method for processing network accounting 
information, comprising: 

(a) receiving accounting information over a packet-switched network; 

(b) detecting a scan of a plurality of ports; 

(c) detecting a scan of a plurality of Internet Protocol (IP) addresses; 

(d) detecting a rate of receipt of the accounting information; 

(e) detecting whether the rate of receipt of the accounting information exceeds a 
predetermined amount; 

(f) detecting a load on a system receiving the accounting information; 
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(g) conditionally preventing an overload of the accounting information based on 
aspects detected during steps (b)-(f); and 

(h) generating a summary of the accounting information; 

(i) wherein the accounting information that occurs during a surge in network 
traffic is discarded. 



PACE 7/8 " RCVD AT 1/29/2005 9:05:08 PM [Eastern Standard Time] * SVR:USPTO-EFXRF-1/0 * DNIS:8729308 * CSID:408 971 4690 " DURATION (mm-ss):02-22 



